From owner-freebsd-questions@FreeBSD.ORG  Mon Jul 10 23:14:16 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4C14416A5F1
	for <freebsd-questions@freebsd.org>;
	Mon, 10 Jul 2006 23:14:16 +0000 (UTC) (envelope-from cswiger@mac.com)
Received: from pi.codefab.com (pi.codefab.com [199.103.21.227])
	by mx1.FreeBSD.org (Postfix) with ESMTP id CED6543D45
	for <freebsd-questions@freebsd.org>;
	Mon, 10 Jul 2006 23:14:15 +0000 (GMT) (envelope-from cswiger@mac.com)
Received: from localhost (localhost [127.0.0.1])
	by pi.codefab.com (Postfix) with ESMTP id 37BAD60EB;
	Mon, 10 Jul 2006 19:14:15 -0400 (EDT)
X-Virus-Scanned: amavisd-new at codefab.com
Received: from pi.codefab.com ([127.0.0.1])
	by localhost (pi.codefab.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id VMXqTSZrdc8o; Mon, 10 Jul 2006 19:14:13 -0400 (EDT)
Received: from [192.168.1.251] (pool-68-161-117-245.ny325.east.verizon.net
	[68.161.117.245])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by pi.codefab.com (Postfix) with ESMTP id A63905D00;
	Mon, 10 Jul 2006 19:14:12 -0400 (EDT)
Message-ID: <44B2DF3B.6010303@mac.com>
Date: Mon, 10 Jul 2006 19:14:03 -0400
From: Chuck Swiger <cswiger@mac.com>
User-Agent: Thunderbird 1.5.0.4 (Windows/20060516)
MIME-Version: 1.0
To: Ensel Sharon <user@dhp.com>
References: <Pine.LNX.4.21.0607101740470.12027-100000@shell.dhp.com>
In-Reply-To: <Pine.LNX.4.21.0607101740470.12027-100000@shell.dhp.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-questions@freebsd.org
Subject: Re: Sanity-check for my (working) ipfw rules  please...
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Jul 2006 23:14:16 -0000

Ensel Sharon wrote:
[ ... ]
> Two questions:  is it appropriate to have line 01000 above all of my
> bad-behavior lines ?

"established" means "ACK and not SYN", basicly.  Your "bad behavior" rules 
wouldn't really match anything which matches established, but it's probably 
better to block known-bad stuff earlier on.

However, it's not the same thing as stateful tracking, which you might want to 
consider using depending on what you're doing...

-- 
-Chuck